T-Home Speedport W 722V Typ B

This device is not supported yet.

The T-Home Speedport W 722V Typ B (VGV8529HW22) is an IAD sold by Deutsche Telekom with an ADSL2+/VDSL2 modem, 802.11abgn wifi and two FXS ports as well as a S0 bus connector.
The device is manufactured by Arcadyan.

State of the OpenWrt port

I have no clue how the encryption of the firmware image works, see Bootloader, please help!

LED

WIP

I've to map the GPIO pins. Should be easy.

USB

✔

Telephony

WIP

Other lantiq based devices support this.

I've derived basic support for this device. You can flash a squashfs image via serial console and boot it with u-boot (in memory). However, I'm unable to create an image that can be booted by the brn-boot bootloader. I found some information on the web, that might help someone (with some C skills) to encrypt the squashfs image in order to boot OpenWrt with brn-boot. See Bootloader.
You could also flash u-boot into the boot partition, but this might brick your device and you lose the ability to go back to the stock firmware!

Flash custom firmware

→ brnboot
Start your serial terminal, press the space bar 3 times (as soon as the device is powered on) to access the bootloader. The access password are the first 4 digits of your "Gerätepasswort" (device password). Press return to see help menu. Press "!" to access the hidden administrator mode with extended
options. Press "k" to run the minikernel, which will run a webserver on 192.168.2.1:80 with recovery options.

Bootloader

The device uses brnboot as bootloader. With more recent versions of brnboot, Arcadyan got more imaginative with their obfuscation/encryption algorithms.

In a flash dump of the bootloader I found two encryption keys:
0x1FBEC - 0x1FBEF: DB35C850
0x1FC00 - 0x1FC09: The null termianted ASCII String "BRNDTW722"

I tried the method described in the wiki article for ARV7506. I was now able to flash the image via the bootloader's recovery webinterface (signature BRNDTW722 seems to be correct).
However, the bootloader didn't boot the encrypted image.

In the German ip-phone-forum I found some information about the encryption methods used by the bootlaoder of this device. In this thread, it is described how to decrypt the firmware and a C program (for Windows ) is provided.